CVE-2020-1893: High severity Facebook HHVM vulnerability

Q: What is CVE-2020-1893?

CVE-2020-1893 is a vulnerability in HHVM that allows reading out of bounds memory when decoding JSON, potentially leading to denial of service (DOS) attacks.

Q: Which versions of HHVM are affected by CVE-2020-1893?

HHVM versions 4.45.0, 4.44.0, 4.43.0, 4.42.0, 4.41.0, 4.40.0, 4.39.0, and all versions between 4.9.0 and 4.38.0 (inclusive) are affected by CVE-2020-1893.

Q: What is the severity of CVE-2020-1893?

CVE-2020-1893 has a severity rating of 7.5, which is considered high.

Q: How can CVE-2020-1893 be exploited?

CVE-2020-1893 can be exploited by sending specially crafted JSON data to the vulnerable HHVM server, triggering the out-of-bounds memory read.

Q: Is there a security update available to fix CVE-2020-1893?

Yes, a security update is available for HHVM to address CVE-2020-1893. It is recommended to update to a patched version of HHVM as soon as possible.

Published Mar 3, 2020

Updated

Insufficient boundary checks when decoding JSON in TryParse reads out of bounds memory, potentially leading to DOS. This issue affects HHVM 4.45.0, 4.44.0, 4.43.0, 4.42.0, 4.41.0, 4.40.0, 4.39.0, versions between 4.33.0 and 4.38.0 (inclusive), versions between 4.9.0 and 4.32.0 (inclusive), and versions prior to 4.8.7.

Affected Software

10 affected components

Facebook HHVM<4.8.7

Facebook HHVM>=4.9.0<=4.32.0

Facebook HHVM>=4.33.0<=4.38.0

Facebook HHVM=4.39.0

Facebook HHVM=4.40.0

Facebook HHVM=4.41.0

Facebook HHVM=4.42.0

Facebook HHVM=4.43.0

Facebook HHVM=4.44.0

Facebook HHVM=4.45.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade hhvm to a version that resolves this vulnerability.
Fixed in 4.8.7
Upgrade
Upgrade hhvm to a version that resolves this vulnerability.
Fixed in 4.39.0
Upgrade
Upgrade hhvm to a version that resolves this vulnerability.
Fixed in 4.40.0
Upgrade
Upgrade hhvm to a version that resolves this vulnerability.
Fixed in 4.41.0
Upgrade
Upgrade hhvm to a version that resolves this vulnerability.
Fixed in 4.42.0
Upgrade
Upgrade hhvm to a version that resolves this vulnerability.
Fixed in 4.43.0
Upgrade
Upgrade hhvm to a version that resolves this vulnerability.
Fixed in 4.44.0
Upgrade
Upgrade hhvm to a version that resolves this vulnerability.
Fixed in 4.45.0

Event History

Mar 3, 2020

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

DescriptionWeakness

Data Sourced

via NVD·03:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2020-1893?

CVE-2020-1893 is a vulnerability in HHVM that allows reading out of bounds memory when decoding JSON, potentially leading to denial of service (DOS) attacks.

Which versions of HHVM are affected by CVE-2020-1893?

HHVM versions 4.45.0, 4.44.0, 4.43.0, 4.42.0, 4.41.0, 4.40.0, 4.39.0, and all versions between 4.9.0 and 4.38.0 (inclusive) are affected by CVE-2020-1893.

What is the severity of CVE-2020-1893?

CVE-2020-1893 has a severity rating of 7.5, which is considered high.

How can CVE-2020-1893 be exploited?